CVE-2025-67746lowCWE-74

CVE-2025-67746: low-severity vulnerability in composer

Composer vulnerable to ANSI sequence injection

Published

Follow this CVE+ Monitor composer+ Monitor composer/composer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 1.3epss 0.5%
Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Affected products
composer · composer
Related CVEs — composer

In the same product, most dangerous first.

CVE-2021-29472HIGHMissing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composerEPSS 4.8%CVE-2024-35242HIGHComposer vulnerable to command injection via malicious git/hg branch namesEPSS 3.3%CVE-2021-41116HIGHCommand injection in composer on WindowsEPSS 2.8%CVE-2022-24828HIGHMissing input validation can lead to command execution in composerEPSS 1.9%CVE-2026-40261HIGHComposer has Command Injection via Malicious Perforce ReferenceEPSS 1.7%CVE-2023-43655MEDIUMRemote Code Execution via web-accessible composer.pharEPSS 1.5%